Busari Ibraheem Akin

A Full-Stack Developer | A Tech Founder | A Fintech Owner | A Serial Entrepreneur

[Busari Ibraheem Akin @hibee054]

I genuinely want to see your ideas become businesses.

And even if I couldn't personally build it with you, I’m still rooting for you.

[Busari Ibraheem Akin @hibee054]

To my friends who have come to me with one project or another, offering different arrangements — CTO roles, shares, partnerships, and so on — asking me to help build your projects, but I wasn't able to make it work…

Please know that I have no bad...

[Busari Ibraheem Akin @hibee054]

Operations is another.

This is not the time to sit back and relax because the MVP is almost ready.

If we've built something, let's give it a chance to succeed.

Keep pushing. Keep testing. Keep talking to potential customers. Keep learning. Keep looking for opportunities.

[Busari Ibraheem Akin @hibee054]

6 tests that break 90% of AI-built apps.

I turned them into a checklist.

Save it. Test your app this weekend. 👇

#Techsplanation

[Busari Ibraheem Akin @hibee054]

Your login needs a bouncer.

Add captcha after 3 fails + alert the owner.

Strong password isn't enough. Your login should know when someone's guessing too much.

#Techsplanation

[Busari Ibraheem Akin @hibee054]

What if I tried logging into your admin account 10,000 times...

And your website never stopped me?

No CAPTCHA. No lockout. No email.

This is missing rate limiting — and AI NEVER adds it by default.

[Busari Ibraheem Akin @hibee054]

It's like a bank vault that lets you try combinations forever without calling security.

Test your own app:
Log out → try wrong password 20 times fast.
Does it ever block you?

If no — I can brute-force you all night with 5 lines of code.

[Busari Ibraheem Akin @hibee054]

Test your app NOW:
1. Sign up 2. F12 → Network → signup request 3. Resend with "role":"admin"
If you become admin — fix this today.

Fix: Only allow safe fields. YOU set role=user in code.

#Techsplanation #BuildInPublic

[Busari Ibraheem Akin @hibee054]

What if I sign up on your website and make myself admin? 😳

Not hacking. Just add:
"role": "admin"

And you let me in as admin.

[Busari Ibraheem Akin @hibee054]

This is MASS ASSIGNMENT.

AI builds signup like:
db.users.create(req.body)

It saves EVERYTHING the user sends. Including role.

[Busari Ibraheem Akin @hibee054]

Rule: Frontend → YOUR backend → Stripe / OpenAI
Never: new Stripe("sk_live_...") in frontend
Only: process.env.STRIPE_KEY on backend

Go F12 → Search sk_live now. If you see it, rotate it TODAY.

#Techsplanation #BuildInPublic

[Busari Ibraheem Akin @hibee054]

What if I Inspect your website and find this?

STRIPE_SECRET_KEY=sk_live_...

What could I do with it? Don't answer yet. Go check. 🧵

[Busari Ibraheem Akin @hibee054]

If your browser can see a secret... It's not a secret anymore.

AI loves putting secrets in frontend. It works. Until someone presses F12.